Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

6/21/2013
12:25 AM
50%
50%

Cloud Can Simplify Vulnerability Management For SMBs

Lacking security skills, most small and midsize businesses need help in locking down their information technology, including cataloging and triaging vulnerabilities

Even with a relatively small number of systems, tracking down and triaging vulnerabilities is a complex enough task that many small and midsize businesses (SMB) set their systems to automatically update software and rarely check the results.

For SMBs, finding an employee with the expertise and time to catalog the devices connected to the network and routine scan for vulnerabilities is tough, says Kiran Kumar, product manager at vulnerability management firm Qualys. Most often, companies do occasional vulnerability scanning as part of the requirements necessary to comply with security standards, such as the Payment Card Industry's Data Security Standard (PCI-DSS). But companies that want better security need to do more than that, he says.

"We all know they have very limited IT resources and time, but this is a key area that they need for security," Kumar says. "While some of them just do it for their quarterly scanning requirement, there are others that are building up a team, even with two people. They want to use this to reassure their customers and give them more security credibility."

Vulnerability and patch management are a critical part of keeping businesses and their networks safe. SMBs that rely on their firewalls and antivirus software to protect their servers and employees' systems are not doing enough: Continuously monitoring the vulnerabilities present in a company's network comes in at No. 4 on the SANS Institute's Top-20 list of critical security controls.

Enterprise-class vulnerability management is typically not well-suited for smaller businesses, but a wide variety of companies offer on-premise products that catalog a company's IT assets and then checks them for vulnerabilities. From GFI's LanGuard to VMware's vCenter Protect, and from Rapid7's Nexpose to Tenable's Nessus, the products and services run the gamut from barebones to a large feature set.

Yet a number of companies are specifically targeting SMBs and their lack of IT security knowledge with cloud services that audit networks, detect vulnerabilities, and helps companies remediate the issues.

[If the definition of insanity is doing the same thing over and over and expecting different results, then today's IT security departments may just be a little nutty about vulnerability management. See Is Vulnerability Management Broken?.]

In 2012, nCircle, now part of Tripwire, released its PureCloud offering that performs asset discovery and vulnerability assessment via a cloud service. IT management firm Kaseya has a full-features platform that includes vulnerability scanning and patch deployment. Vulnerability management firm Secunia adds patching as well, aiming to offer in a single service the ability to catalog issues and then patch the problems, according to Morten Stengaard, chief technology officer of the firm.

"We want to get to the point that, if you don't have a security team, then you can still secure your systems," Stengaard said during an interview at the RSA Security Conference earlier this year.

In July, Qualys will launch a SMB-focused version of its own vulnerability management tool, QualysGuard Express Lite. The service will scan for vulnerabilities inside the network, scan for Web application vulnerabilities externally, and product compliance reports, Qualys's Kumar says.

"Basically, we want to help them turn scanning into something that keeps on happening automatically," he says. "We want the SMBs to really focus on growing their business."

Kumar and others stress that companies should not treat vulnerability management as a compliance exercise. Recent reports suggest that companies that focus on their security -- and use the cloud to provide secure services -- have a higher level of security and more success. A study sponsored by Microsoft, for example, found that six out of 10 companies that do not use the cloud cite security concerns as a primary reason, but that 94 percent of SMBs that adopted the cloud say it improved their security posture.

In a study released this week, security firm Symantec found that 78 percent of the top-performing third of SMBs felt they were at least somewhat secure, compared to only 39 percent of the worst-performing third. In addition, losses from successful attacks were 51 percent lower than the poor performers, said Andrew Singer, director of product marketing for small business at Symantec, in an e-mail interview.

"While we didn’t ask specifically about how they deal with vulnerabilities and patch management, it stands to reason that the top-ranking SMBs who make IT a priority are better able to deal with vulnerability-related issues," he said.

In addition to taking advantage of the expertise incorporated into cloud services, SMBs should also apply patches as soon as possible and block access to all internal systems from outside the network, he said.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Malicious USB Drive Hides Behind Gift Card Lure
Dark Reading Staff 3/27/2020
How Attackers Could Use Azure Apps to Sneak into Microsoft 365
Kelly Sheridan, Staff Editor, Dark Reading,  3/24/2020
8 Infosec Page-Turners for Days Spent Indoors
Kelly Sheridan, Staff Editor, Dark Reading,  3/23/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5527
PUBLISHED: 2020-03-30
When MELSOFT transmission port (UDP/IP) of Mitsubishi Electric MELSEC iQ-R series (all versions), MELSEC iQ-F series (all versions), MELSEC Q series (all versions), MELSEC L series (all versions), and MELSEC F series (all versions) receives massive amount of data via unspecified vectors, resource co...
CVE-2020-5551
PUBLISHED: 2020-03-30
Toyota 2017 Model Year DCU (Display Control Unit) allows an unauthenticated attacker within Bluetooth range to cause a denial of service attack and/or execute an arbitrary command. The affected DCUs are installed in Lexus (LC, LS, NX, RC, RC F), TOYOTA CAMRY, and TOYOTA SIENNA manufactured in the re...
CVE-2020-10940
PUBLISHED: 2020-03-27
Local Privilege Escalation can occur in PHOENIX CONTACT PORTICO SERVER through 3.0.7 when installed to run as a service.
CVE-2020-10939
PUBLISHED: 2020-03-27
Insecure, default path permissions in PHOENIX CONTACT PC WORX SRT through 1.14 allow for local privilege escalation.
CVE-2020-6095
PUBLISHED: 2020-03-27
An exploitable denial of service vulnerability exists in the GstRTSPAuth functionality of GStreamer/gst-rtsp-server 1.14.5. A specially crafted RTSP setup request can cause a null pointer deference resulting in denial-of-service. An attacker can send a malicious packet to trigger this vulnerability.